Make fixes and improvements

- Invent iso8601us() for faster timestamps
- Improve --strace descriptions of sigset_t
- Rebuild the Landlock Make bootstrap binary
- Introduce MODE=sysv for non-Windows builds
- Permit OFD fcntl() locks under pledge(flock)
- redbean can now protect your kernel from ddos
- Have vfork() fallback to sys_fork() not fork()
- Change kmalloc() to not die when out of memory
- Improve documentation for some termios functions
- Rewrite putenv() and friends to conform to POSIX
- Fix linenoise + strace verbosity issue on Windows
- Fix regressions in our ability to show backtraces
- Change redbean SetHeader() to no-op if value is nil
- Improve fcntl() so SQLite locks work in non-WAL mode
- Remove some unnecessary work during fork() on Windows
- Create redbean-based SSL reverse proxy for IPv4 TurfWar
- Fix ape/apeinstall.sh warning when using non-bash shells
- Add ProgramTrustedIp(), and IsTrustedIp() APIs to redbean
- Support $PWD, $UID, $GID, and $EUID in command interpreter
- Introduce experimental JTqFpD APE prefix for non-Windows builds
- Invent blackhole daemon for firewalling IP addresses via UNIX named socket
- Add ProgramTokenBucket(), AcquireToken(), and CountTokens() APIs to redbean

libc/runtime/enable_tls.c

@@ -19,6 +19,7 @@
 #include "ape/sections.internal.h"
 #include "libc/assert.h"
 #include "libc/calls/calls.h"
+#include "libc/calls/struct/sigset.h"
 #include "libc/calls/syscall-sysv.internal.h"
 #include "libc/dce.h"
 #include "libc/errno.h"
@@ -32,6 +33,7 @@
 #include "libc/nexgen32e/msr.h"
 #include "libc/nt/thread.h"
 #include "libc/runtime/internal.h"
+#include "libc/runtime/morph.h"
 #include "libc/runtime/runtime.h"
 #include "libc/stdalign.internal.h"
 #include "libc/str/str.h"
@@ -196,9 +198,10 @@ privileged void __enable_tls(void) {
   if ((intptr_t)_tls_content && (IsWindows() || IsXnu())) {
     int n;
     uint64_t w;
+    sigset_t mask;
     unsigned m, dis;
     unsigned char *p;
-    __morph_begin();
+    __morph_begin(&mask);
 
     if (IsXnu()) {
       // Apple is quite straightforward to patch. We basically
@@ -262,7 +265,7 @@ privileged void __enable_tls(void) {
       }
     }
 
-    __morph_end();
+    __morph_end(&mask);
   }
 
   // we are now allowed to use tls